CVE-2026-45160
June 10, 2026, 2:16 a.m.
6.5
Medium
Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and declared payload length stay within the received packet buffer. A crafted DHCP request can cause the parser to read past the end of the options buffer into adjacent heap memory. The issue affects the DHCP server used by ESP-IDF's SoftAP and any configuration where the device runs as a DHCP server on a local network. This issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Espressif |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | espressif | esp-idf | 5.2.7 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | 5.3.5 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | 5.4.4 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | 5.5.4 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | 6.0.1 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | <5.2.8 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | <5.3.6 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | <5.4.5 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | <5.5.5 | / | / | / | / | / | / | / |
| a | espressif | esp-idf | <6.0.2 | / | / | / | / | / | / | / |
References
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: ADJACENT_NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: UNCHANGED
- Confidentiality Impact: NONE
- Integrity Impact: NONE
- Availability Impact: HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Timeline
Published: June 10, 2026, 2:16 a.m.
Last Modified: June 10, 2026, 2:16 a.m.
Last Modified: June 10, 2026, 2:16 a.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.